CVE-2020-1192: Visual Studio Code RCE

CISO Take

This is a remote code execution flaw in the VS Code Python extension, triggered when it parses workspace settings embedded in a notebook file — opening a booby-trapped file runs arbitrary code as the current user, and grants full system takeover if that user has admin rights. For AI/ML teams, VS Code plus the Python extension is the default IDE for Jupyter notebook-based development, so this sits in the data scientist and ML engineer workstation attack surface, though exploitation requires convincing a specific person to open a crafted file rather than any remote, unauthenticated path. EPSS sits at 0.041 (top 10% percentile relative to the broader CVE population despite a low absolute score), it is not in CISA KEV, and there is no public exploit code or Nuclei template, so this reads as a social-engineering-gated risk rather than an actively weaponized one. Microsoft shipped a fix in the Python extension in 2020 changing how workspace settings are enforced — confirm the extension is current, enable VS Code Workspace Trust for untrusted repos/notebooks, and reinforce policy against opening notebooks received from outside the org.

Sources:NVDEPSSmsrc.microsoft.comATLAS

What is the risk?

Low-to-moderate operational risk. The vulnerability is old (2020), already patched, not in CISA KEV, has no public exploit or scanner template, and requires user interaction (opening a specially crafted file) rather than being remotely triggerable. EPSS is low in absolute terms (0.041) though relatively high percentile (top 10%), which mainly reflects broad targeting of developer tooling rather than AI-specific exploitation. Residual risk today is concentrated in unpatched, long-lived developer environments — common in research/ML teams that update tooling infrequently.

How does the attack unfold?

Malicious notebook delivery

Attacker crafts a notebook file with malicious embedded workspace settings and convinces the target to open it in VS Code.

AML.T0011

Arbitrary code execution

The Python extension loads the crafted workspace settings and executes attacker-controlled code as the current user.

AML.T0050

Workstation compromise

Attacker gains a foothold on the ML engineer's machine, enabling credential theft, data exfiltration, or lateral movement into training/deployment infrastructure.

Malicious notebook delivery

Attacker crafts a notebook file with malicious embedded workspace settings and convinces the target to open it in VS Code.

AML.T0011

Arbitrary code execution

The Python extension loads the crafted workspace settings and executes attacker-controlled code as the current user.

AML.T0050

Workstation compromise

Attacker gains a foothold on the ML engineer's machine, enabling credential theft, data exfiltration, or lateral movement into training/deployment infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Visual Studio Code	—	—	No patch

Do you use Visual Studio Code? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

4.3%

chance of exploitation in 30 days

Higher than 91% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Verify the VS Code Python extension is updated past the 2020 fixed version (workspace settings enforcement patch). 2) Enable and enforce VS Code Workspace Trust so untrusted folders/notebooks don't auto-apply settings. 3) Establish policy/training against opening notebooks or repos from unverified external sources. 4) For ML teams, treat inbound .ipynb files (via email, shared drives, or unfamiliar repos) as untrusted attachments subject to sandboxing/review before opening. 5) EDR detection: alert on VS Code/Python extension processes spawning unexpected child processes or shells shortly after a file-open event.

How is it classified?

Code ExecutionSocial EngineeringPluginAML.T0011- User Execution AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2-Resources and infrastructure for AI system development

NIST AI RMF

GOVERN-4-Organizational risk tolerance and third-party tooling

Frequently Asked Questions

What is CVE-2020-1192?

This is a remote code execution flaw in the VS Code Python extension, triggered when it parses workspace settings embedded in a notebook file — opening a booby-trapped file runs arbitrary code as the current user, and grants full system takeover if that user has admin rights. For AI/ML teams, VS Code plus the Python extension is the default IDE for Jupyter notebook-based development, so this sits in the data scientist and ML engineer workstation attack surface, though exploitation requires convincing a specific person to open a crafted file rather than any remote, unauthenticated path. EPSS sits at 0.041 (top 10% percentile relative to the broader CVE population despite a low absolute score), it is not in CISA KEV, and there is no public exploit code or Nuclei template, so this reads as a social-engineering-gated risk rather than an actively weaponized one. Microsoft shipped a fix in the Python extension in 2020 changing how workspace settings are enforced — confirm the extension is current, enable VS Code Workspace Trust for untrusted repos/notebooks, and reinforce policy against opening notebooks received from outside the org.

Is CVE-2020-1192 actively exploited?

No confirmed active exploitation of CVE-2020-1192 has been reported, but organizations should still patch proactively.

How to fix CVE-2020-1192?

1) Verify the VS Code Python extension is updated past the 2020 fixed version (workspace settings enforcement patch). 2) Enable and enforce VS Code Workspace Trust so untrusted folders/notebooks don't auto-apply settings. 3) Establish policy/training against opening notebooks or repos from unverified external sources. 4) For ML teams, treat inbound .ipynb files (via email, shared drives, or unfamiliar repos) as untrusted attachments subject to sandboxing/review before opening. 5) EDR detection: alert on VS Code/Python extension processes spawning unexpected child processes or shells shortly after a file-open event.

What systems are affected by CVE-2020-1192?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, notebook-based development environments.

What is the CVSS score for CVE-2020-1192?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesnotebook-based development environments

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: GOVERN-4

What are the technical details?

Original Advisory

A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed. The update address the vulnerability by modifying the way Visual Studio Code Python extension enforces user settings.

Exploitation Scenario

An attacker crafts a malicious Jupyter notebook (.ipynb) or workspace settings file and delivers it to a target ML engineer or data scientist — e.g., disguised as a shared research notebook via email, Slack, or a public code repository. The victim opens the file in VS Code with the Python extension installed; the extension loads the embedded workspace settings and executes attacker-controlled code in the user's context. If the victim has elevated rights, the attacker gains a foothold to install tooling, exfiltrate training data or model artifacts, harvest cloud/API credentials stored on the workstation, or pivot into the organization's ML pipeline.